From f006289ddc7249e5dfa619c757b31989a47a7f24 Mon Sep 17 00:00:00 2001 From: fargo Date: Wed, 19 Aug 2026 17:06:28 -0500 Subject: [PATCH] fix(#1323): remove legacy credential read and force-merge recipe from mosaic-gitea MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same defect class as the #1320 Should Fix, at the two spots the #1320 file list missed (found by rev-security-01's review of #1322, filed as #1323): - Setup section framed a shared-credential env read (~/.config/mosaic/credentials/gitea.env — no longer part of the credential system) as the way to enable force-merges. The credentials loader is now the only documented source, and the force-merge framing is gone. - 'Force-merge bypassing branch protection' section carried the full raw curl + force_merge:true recipe. Replaced with the same wrapper-only guidance merged in #1322: protection blocks are signals to fix, never to bypass; exceptional cases go to the operator or coordinating seat, still through the wrapper. Scan before fixing (whole shipped framework tree, three patterns — gitea.env / credentials/*.env reads, force_merge, raw merge curl): the two handed spots in mosaic-gitea were the complete set; no seventh carrier. Post-fix rescan: zero recipe matches; the only force_merge strings left are the guidance text that forbids it. Closes #1323. --- .../framework/skills/mosaic-gitea/SKILL.md | 21 ++++++------------- 1 file changed, 6 insertions(+), 15 deletions(-) diff --git a/packages/mosaic/framework/skills/mosaic-gitea/SKILL.md b/packages/mosaic/framework/skills/mosaic-gitea/SKILL.md index fd1a8818..9ae65e62 100644 --- a/packages/mosaic/framework/skills/mosaic-gitea/SKILL.md +++ b/packages/mosaic/framework/skills/mosaic-gitea/SKILL.md @@ -11,13 +11,8 @@ Git operations via Mosaic wrapper scripts. Platform-aware (Gitea or GitHub). Scripts auto-detect platform from git remote. Run from inside the repo directory. -For force-merge (branch protection bypass): - -```bash -GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2) -``` - -Or use the credentials loader: +Credentials come from the framework credentials loader (never from a shared env +file): ```bash source ~/.config/mosaic/tools/_lib/credentials.sh @@ -86,14 +81,10 @@ cd ~/src/ ~/.config/mosaic/tools/git/pr-merge.sh -n -d ``` -**Force-merge bypassing branch protection:** - -```bash -GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2) -curl -X POST "https://git.mosaicstack.dev/api/v1/repos///pulls//merge" \ - -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \ - -d '{"Do":"squash","force_merge":true}' -``` +Branch protection is a gate, not an obstacle: if it blocks a merge, fix the cause — +a failing check, a moved head, or a missing review. Never bypass it with a raw +API call, a shared credential, or `force_merge`. Exceptional cases go to the +operator or the coordinating seat, still merged through the wrapper. ## Notes